GHSL-2024-034: Privilege escalation in memos - CVE-2024-41659
A CORS misconfiguration exists in memos where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account.
Affected Software
Event History
Frequently Asked Questions
What is the severity of GHSL-2024-034?
The severity of GHSL-2024-034 is rated at 57, indicating a moderate risk of exploitation.
How do I fix GHSL-2024-034?
To fix GHSL-2024-034, you need to update the CORS configuration to restrict allowed origins and set Access-Control-Allow-Credentials to false.
What type of vulnerability is GHSL-2024-034?
GHSL-2024-034 is a privilege escalation vulnerability due to misconfigured CORS settings.
What systems are affected by GHSL-2024-034?
GHSL-2024-034 affects the memos software by usememos.
Can GHSL-2024-034 be exploited remotely?
Yes, GHSL-2024-034 can be exploited remotely through cross-origin requests from an attacking website.